perfSONAR 4.4.4 Open Proxy / Relay | allinfosecnews.com

Nov. 30, 2022, 9:16 p.m. |

Packet Storm packetstormsecurity.com

perfSONAR bundles with it a graphData.cgi script, used to graph and visualize data. There is a flaw in graphData.cgi allowing for unauthenticated users to proxy and relay HTTP/HTTPS traffic through the perfSONAR server. The vulnerability can potentially be leveraged to exfiltrate or enumerate data from internal web servers. This vulnerability was patched in perfSONAR version 4.4.5. Versions 4.x through 4.4.4 are affected. There is a whitelisting function that will mitigate, but is disabled by default.

More from packetstormsecurity.com / Packet Storm

Debian Security Advisory 5665-1 1 day, 22 hours ago | packetstormsecurity.com

advisory debian debian linux security engine +7

Debian Security Advisory 5664-1 1 day, 22 hours ago | packetstormsecurity.com

advisory attackers can clients +20

Elber Wayber Analog/Digital Audio STL 4.00 Insecure Direct Object Reference 1 day, 22 hours ago | packetstormsecurity.com

audio client client-side configuration +11

Elber Wayber Analog/Digital Audio STL 4.00 Authentication Bypass 1 day, 22 hours ago | packetstormsecurity.com

access attackers audio authentication +15

Elber ESE DVB-S/S2 Satellite Receiver 1.5.x Insecure Direct Object Reference 1 day, 22 hours ago | packetstormsecurity.com

client client-side configuration device +12

Elber ESE DVB-S/S2 Satellite Receiver 1.5.x Authentication Bypass 1 day, 22 hours ago | packetstormsecurity.com

access attackers authentication authentication bypass +16

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Insecure Direct Object Reference 1 day, 22 hours ago | packetstormsecurity.com

client client-side configuration device +10

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass 1 day, 22 hours ago | packetstormsecurity.com

access attackers authentication authentication bypass +14

Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Insecure Direct Object Reference 1 day, 22 hours ago | packetstormsecurity.com

1.0.0 broadcast client client-side +14

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

View on infosec-jobs.com

Information Security Engineers

@ D. E. Shaw Research | New York City

View on infosec-jobs.com

Staff DFIR Investigator

@ SentinelOne | United States - Remote

View on infosec-jobs.com

Senior Consultant.e (H/F) - Product & Industrial Cybersecurity

@ Wavestone | Puteaux, France

View on infosec-jobs.com

Information Security Analyst

@ StarCompliance | York, United Kingdom, Hybrid

View on infosec-jobs.com

Senior Cyber Security Analyst (IAM)

@ New York Power Authority | White Plains, US

View on infosec-jobs.com